CVE-2024-1023
Eclipse Vert.x memory leak
6.5
MEDIUM
CVSS 3.1
EPSS 1.6%
描述
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak.
如何修補 CVE-2024-1023
要修補 CVE-2024-1023,請將受影響套件升級到下列已修補版本。
- —升級至 4.5.2 或更新版本
CVE-2024-1023 正在被利用嗎?
低 — EPSS 為 1.6%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 4.5.0, < 4.5.2
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |